iommu: DMA-region capabilities — per-grant reachability, protocol flag-day

Replaces L2's interim DMA pool (every buffer reachable by every claimed
device) with true per-grant confinement: a device reaches only buffers
whose capability was delegated to its driver.

Kernel:
- DmaRegionObject (handle kind 2): a delegation token naming a dma_alloc'd
  region, passable across processes on the IPC cap slot like an endpoint
  or shared-memory object. Frames stay owned by the allocating address
  space (freed on dma_free/teardown as before); the token carries a `dead`
  flag so a stale downstream handle can no longer bind a freed region.
- dma_alloc gains the dma_shareable flag: it returns a capability handle
  in r8 and every region is tracked in a registry. A task's own regions
  auto-bind into the devices it claims (its rings just work); foreign
  buffers are bound explicitly.
- dma_bind / dma_unbind / handle_close syscalls (51-53). dma_bind maps a
  held region (or shared-memory) capability into a claimed device's domain;
  it is idempotent. handle_close reclaims a table slot (raised 16 -> 32).
- dma_free and task death unmap a region from every domain and invalidate
  BEFORE its frames return to the allocator — the stale-IOTLB use-after-
  free window, closed structurally.

Protocols (flag-day): block gains attach, usb-transfer gains dma_attach —
each carries a region capability on the cap slot. fat allocates its bounce
buffer shareable and attaches it; usb-storage allocates its transport
buffers shareable, attaches them to the controller, and forwards fat's
capability downstream; usb-xhci-bus binds and closes; virtio-gpu binds its
shared scanout surface. The physical addresses on the wire are unchanged
(identity IOVA), so no register-programming code moved.

Cross-process DMA (fat -> usb-storage -> xHC) now flows only through
delegated capabilities. iommu-usb-storage / iommu-usb-hid / iommu-fault
all green under per-grant enforcement; 104/104 overall (fail-open paths
unchanged).

system/drivers/usb-storage/usb-storage.zig

@@ -90,9 +90,22 @@ fn initialise(endpoint: ipc.Handle) bool {
         bring_up_failed = true;
         return false;
     };
-    command_wrapper = memory.dmaAlloc(4096, memory.dma_coherent) orelse return false;
-    status_wrapper = memory.dmaAlloc(4096, memory.dma_coherent) orelse return false;
-    command_data = memory.dmaAlloc(4096, memory.dma_coherent) orelse return false;
+    // Shareable, so each buffer's capability can be handed to the controller: usb-storage
+    // owns no device, so its buffers are not auto-bound anywhere — the controller reaches
+    // them only once attached. (No-op binding when no IOMMU is enforcing.)
+    command_wrapper = memory.dmaAlloc(4096, memory.dma_coherent | memory.dma_shareable) orelse return false;
+    status_wrapper = memory.dmaAlloc(4096, memory.dma_coherent | memory.dma_shareable) orelse return false;
+    command_data = memory.dmaAlloc(4096, memory.dma_coherent | memory.dma_shareable) orelse return false;
+    for ([_]memory.DmaRegion{ command_wrapper, status_wrapper, command_data }) |region| {
+        if (region.handle) |handle| {
+            if (!device.attachDma(handle)) {
+                _ = logging.write("/system/drivers/usb-storage: could not attach a DMA buffer to the controller\n");
+                bring_up_failed = true;
+                return false;
+            }
+            _ = ipc.close(handle); // the binding holds its own reference now
+        }
+    }
 
     // Bring the LUN up: wait for it to be ready (clearing the initial unit-attention
     // with REQUEST SENSE), identify it, and read its capacity.
@@ -135,10 +148,17 @@ fn initialise(endpoint: ipc.Handle) bool {
 /// caller's DMA buffer (named by physical address).
 fn onMessage(message: []const u8, reply: []u8, sender: u32, capability: ?ipc.Handle) usize {
     _ = sender;
-    _ = capability;
     if (message.len < block_protocol.request_size) return 0;
     const request = std.mem.bytesToValue(block_protocol.Request, message[0..block_protocol.request_size]);
     switch (request.operation) {
+        @intFromEnum(block_protocol.Operation.attach) => {
+            // The filesystem's DMA buffer: forward its capability to the controller so
+            // the device can reach it, then release our copy (the binding holds a ref).
+            const handle = capability orelse return writeReply(reply, .{ .status = -1, .block_size = 0, .block_count = 0 });
+            const ok = device.attachDma(handle);
+            _ = ipc.close(handle);
+            return writeReply(reply, .{ .status = if (ok) 0 else -1, .block_size = 0, .block_count = 0 });
+        },
         @intFromEnum(block_protocol.Operation.geometry) => {
             return writeReply(reply, .{ .status = 0, .block_size = block_size, .block_count = block_count });
         },

system/drivers/usb-xhci-bus/usb-xhci-bus.zig

@@ -484,10 +484,22 @@ fn onMessage(message: []const u8, reply: []u8, sender: u32, capability: ?ipc.Han
         @intFromEnum(usb_transfer_protocol.Operation.control) => handleControl(message, reply),
         @intFromEnum(usb_transfer_protocol.Operation.interrupt_subscribe) => handleSubscribe(message, reply),
         @intFromEnum(usb_transfer_protocol.Operation.bulk) => handleBulk(message, reply),
+        @intFromEnum(usb_transfer_protocol.Operation.dma_attach) => handleDmaAttach(message, reply, capability),
         else => 0,
     };
 }
 
+/// dma_attach: bind the class driver's DMA-region capability into the controller's IOMMU
+/// domain, so the controller may DMA to the physical addresses inside that buffer. The
+/// binding holds its own kernel reference, so the forwarded capability is closed here.
+fn handleDmaAttach(message: []const u8, reply: []u8, capability: ?ipc.Handle) usize {
+    if (message.len < @sizeOf(usb_transfer_protocol.DmaAttachRequest)) return writeReply(reply, usb_transfer_protocol.DmaAttachReply{ .status = -1 });
+    const handle = capability orelse return writeReply(reply, usb_transfer_protocol.DmaAttachReply{ .status = -1 });
+    const ok = device.dmaBind(controller_id, handle);
+    _ = ipc.close(handle);
+    return writeReply(reply, usb_transfer_protocol.DmaAttachReply{ .status = if (ok) 0 else -1 });
+}
+
 fn writeReply(reply: []u8, value: anytype) usize {
     const bytes = std.mem.asBytes(&value);
     @memcpy(reply[0..bytes.len], bytes);

system/drivers/virtio-gpu/virtio-gpu.zig

@@ -323,6 +323,15 @@ fn initialise(endpoint: ipc.Handle) bool {
         std.log.info("could not resolve the scanout surface physical address", .{});
         return false;
     };
+    // Bind the shared surface into this device's IOMMU domain so the GPU may DMA the
+    // framebuffer (attach_backing points it here). The ring/command buffers are
+    // dma_alloc'd and auto-bound; a shared-memory surface needs an explicit bind. We keep
+    // the handle (it is also passed to the display service), so do not close it. No-op
+    // without an IOMMU.
+    if (!device.dmaBind(device_id, surface.handle)) {
+        std.log.info("could not bind the scanout surface for DMA", .{});
+        return false;
+    }
     {
         const request = requestAt(vg.ResourceAttachBacking);
         request.* = .{